Most healthcare AI demos fail the same way. They look fluent in a slide. Then someone asks where the answer came from, who saw the prompt, and whether a nurse can override it. Those questions are the product.
ThunderCoders treats a copilot as part of the operations console, not a chat toy. Retrieval is limited to procedures, policies, and records the customer can name. Generation is grounded in those sources. Suggestions are logged. A human approves anything that could touch a chart or a patient record.
What we actually ship
The useful shape is an operator assistant: search approved material, draft a next step, show citations, wait. That is slower than an unbounded model call. It is also something a security owner and an assessor can inspect.
- Identity is the same as the rest of the product. If you cannot open the console, you cannot ask the copilot.
- Every prompt, retrieved chunk, and suggestion is an audit event, with actor, timestamp, and source ids.
- ePHI stays in the systems of record. The model sees the minimum the workflow needs, under the same access rules as the UI.
- There is a kill switch. If evals regress or a source set is stale, the assistant turns off without taking the rest of the app with it.
Independent auditors still issue HIPAA-related opinions and SOC reports. We design the system they inspect: access, logging, change control, and evidence in CI. We do not certify you, and we do not guarantee an audit outcome.
If you are buying a healthcare copilot, ask for the retrieval set, the approval path, and a sample log. If the vendor cannot show those, you do not have a production feature yet.